CVE-2026-92232

Joomla core's InputFilter does not fully remove HTML data URIs when whitespace is inserted, so cleanAttribute can be bypassed and the result is cross-site scripting (CWE-79). An attacker who already has high privileges can submit crafted HTML with a whitespace-obfuscated data URI; a victim who later loads that content can have script run in the browser, with high confidentiality and integrity impact on the site (CVSS 4.0 base 7.1, passive user interaction). Every Joomla site on 1.5.0–5.4.8 or 6.0.0–6.1.3 is in the affected range. It is not in the CISA KEV catalog and no public proof-of-concept is known, so exploitation is not known to be occurring.

What to do: Upgrade to a Joomla release newer than 5.4.8 on the 5.x line or newer than 6.1.3 on the 6.x line; installs still on 1.5 through 4.x should move to a currently supported patched branch rather than staying on those affected ranges. Until then, limit which high-privilege accounts can submit raw HTML and review stored content for data-URI attributes that contain unexpected whitespace.